GitLab Critical Patch Release: 19.3.2, 19.2.6, 19.1.8

On September 10, 2026, we released versions 19.3.2, 19.2.6, 19.1.8 for GitLab Community Edition (CE) and Enterprise Edition (EE).

These versions contain important bug and security fixes, and we strongly recommend that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version. GitLab Dedicated customers do not need to take action.

GitLab releases fixes for vulnerabilities in patch releases. There are two types of patch releases: scheduled releases and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases are released twice a month on the second and fourth Wednesdays. For more information, please visit our releases handbook and security FAQ. You can see all of GitLab release blog posts here.

For security fixes, the issues detailing each vulnerability are made public on our issue tracker 90 days after the release in which they were patched.

We are committed to ensuring that all aspects of GitLab that are exposed to customers or that host customer data are held to the highest security standards. To maintain good security hygiene, it is highly recommended that all customers upgrade to the latest patch release for their supported version. You can read more best practices in securing your GitLab instance in our blog post.

Recommended Action

We strongly recommend that all installations running a version affected by the issues described below are upgraded to the latest version as soon as possible.

When no specific deployment type (omnibus, source code, helm chart, etc.) of a product is mentioned, it means all types are affected.

Security fixes

Table of security fixes

CVE-2026-85706 - Path Traversal issue in repository commits API impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

Impacted Versions: GitLab CE/EE: all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

Thanks s3ntago for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-87719 - Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup.

Impacted Versions: GitLab EE: all versions from 18.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Thanks kyyblin for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-88765 - Buffer Overflow issue in Unicode conversion wrapper impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing.

Impacted Versions: GitLab EE: all versions from 12.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 8.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-79708 - Scheduled Pipeline Execution Policy test allows Developers to access protected CI/CD variables

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with developer permissions to execute a policy test pipeline on projects within their group and access protected CI/CD variables restricted to higher-privileged roles due to insufficient scope validation.

Impacted Versions: GitLab EE: all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 8.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N)

Thanks yvvdwf for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-78252 - Cross-site Scripting issue in Markdown JSON table renderer impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper sanitization of user-controlled data in the Markdown JSON table renderer.

Impacted Versions: GitLab CE/EE: all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 8.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L)

Thanks a_m_a_m for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-13210 - Incorrect Authorization issue in CI/CD environment variable scope matcher impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input validation in the environment scope pattern matcher.

Impacted Versions: GitLab CE/EE: all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

Thanks nwicks for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2025-14871 - Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

Impacted Versions: GitLab CE/EE: all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks hunter0xp7 for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-1168 - Denial of Service issue in GraphQL complexity limiter impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic.

Impacted Versions: GitLab CE/EE: all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Thanks joaxcar for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2024-11222 - Race Condition issue in Merge Request Pipelines impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed a developer user to perform actions in the context of another user’s merge request commit due to a race condition issue in pipeline creation.

Impacted Versions: GitLab CE/EE: all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 6.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N)

Thanks xorz for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-12910 - Improper Authentication issue in SAML SSO sign-in restriction enforcement impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing authentication enforcement checks.

Impacted Versions: GitLab CE/EE: all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Thanks theluci for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-82837 - Insufficiently Protected Credentials issue in Workhorse senddata emitters impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to improper authorization checks on internal data emission endpoints.

Impacted Versions: GitLab CE/EE: all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Thanks 0xoroot for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-19619 - Cross-site Scripting issue in Content Editor impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary JavaScript in the context of a targeted user’s session due to improper sanitization of pasted HTML content in the Content Editor.

Impacted Versions: GitLab CE/EE: all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)

Thanks lucvs for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-86341 - Access Control Implementation issue in protected environment approval rules impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval requirements, allowing unapproved deployments to reach production due to improper access control checks performed after the protected resource was modified.

Impacted Versions: GitLab EE: all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N)

This vulnerability has been discovered internally by GitLab team member Peter Arts.

CVE-2026-86340 - Authorization Bypass issue in protected environment approval rules impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, could allow an authenticated user to bypass required deployment approvals for protected environments by deleting the sole approver group or user account.

Impacted Versions: GitLab EE: all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N)

This vulnerability has been discovered internally by GitLab team member Peter Arts.

CVE-2026-7514 - Missing Authorization issue in Generic Package Registry impacts GitLab CE/EE

GitLab has remediated an issue that an authenticated user with developer-role permissions could substitute package file content and hide packages from their owners due to improper authorization checks in the Generic Package Registry.

Impacted Versions: GitLab CE/EE: all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks toofikz for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-8030 - Improper Input Validation issue in Namespace Transfer impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user to prevent another user from modifying their group settings due to improper validation of group URL slugs during namespace transfers.

Impacted Versions: GitLab CE/EE: all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)

Thanks mateuszek for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-16794 - Missing Authorization issue in Compliance Framework management impacts GitLab EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected variables within group projects due to improper authorization controls on compliance framework management.

Impacted Versions: GitLab EE: all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Thanks manual_mint for reporting this vulnerability through our HackerOne bug bounty program.

CVE-2026-3855 - Improper Input Validation issue in Terraform State API impacts GitLab CE/EE

GitLab has remediated an issue that, under certain conditions, could have allowed an authenticated user with project-level permissions to access restricted file contents on the server or cause denial of service due to improper validation of parameters in the Terraform state upload functionality.

Impacted Versions: GitLab CE/EE: all versions from 18.2.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2
CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)

Thanks ahacker1 for reporting this vulnerability through our HackerOne bug bounty program.

Bug fixes

19.3.2

• 19.3 Backport: Update Ruby version from 3.3.11 to 3.3.12
• Update go to version 1.26.7
• Revert “Merge branch ‘replace_ftp_gnu_org_with_mirror’ into 19.3
• Add whole-diff hash option to GetPatchID
• Backport of ‘Skip Lockable reset_failed_attempts! on read-only replicas’
• Backport of “Show “No available solution” message for CS when solution is empty”
• Backport of ‘Reuse HTTP connections and add timeouts in Gitlab::HttpIO’ (19.3)
• Backport of ‘Cache the previous chunk in Gitlab::HttpIO’ (19.3)
• Backport of ‘Fix broken gcloud auth plugin package name in qa/Dockerfile’
• Backport of Set SHA requirement to false on group creation if ancestor is not locked
• Backport of “Stop logging GraphQL type conflict deprecation warnings”
• Bump websocket-driver from 0.8.0 to 0.8.2 (backport to 19-3-stable-ee)
• Restore Slack notifications documentation page (19.3 backport)
• Backport of Geo: Missing index on ci_job_artifact_states causes slow re-verification UPDATE queries
• Quarantine flaky agentic chat custom-agent spec [19.3]
• Backport of ‘Geo: Support SSH cert gl_id formats in proxied Git requests’
• Backport of ‘Fix empty partition range crashing pipeline lookups (CI outage)’ to 19-3
• Backport of ‘Restore Bitbucket Cloud API-token imports without OAuth provider’
• Backport ‘Stop resetting mcp_server_enabled when Duo settings change’ to 19-3-stable-ee
• Bump concurrent-ruby to version 1.3.8 (19-3-stable)
• Bump alertmanager to v0.34.0 (19-3-stable)
• Bump NGINX to 1.31.4
• Update GO to 1.26.7 on 19-3-stable
• Update dependency redis/redis to v7.2.16 (19-3-stable)
• Bump PostgreSQL to version 17.11 (19-3-stable)
• Bump Consul to version 1.22.7 (19-3-stable)
• Merge branch ‘sdg-fips-staging-upload-internal-release’ into 19.3

19.2.6

• Update go to version 1.26.7
• Revert “Merge branch ‘replace_ftp_gnu_org_with_mirror’ into 19.2
• Add whole-diff hash option to GetPatchID
• Backport of ‘Fix quadratic line reading in CI trace reverse scan’ (19.2)
• Backport of ‘Optimize remote CI artifact parsing and size validation’ (19.2)
• Backport IP fallback in Gitlab::HTTP to 19.2
• Backport of ‘Skip Lockable reset_failed_attempts! on read-only replicas’
• Backport of ‘Reuse HTTP connections and add timeouts in Gitlab::HttpIO’ (19.2)
• Backport of ‘Cache the previous chunk in Gitlab::HttpIO’ (19.2)
• Backport of ‘Fix broken gcloud auth plugin package name in qa/Dockerfile’
• Backport of “Admin setting for cyclonedx report max size”
• Backport of Set SHA requirement to false on group creation if ancestor is not locked
• Bump websocket-driver from 0.8.0 to 0.8.2 (backport to 19-2-stable-ee)
• Quarantine flaky agentic chat custom-agent spec [19.2]
• Backport of ‘Fix empty partition range crashing pipeline lookups (CI outage)’ to 19-2
• ‘Stop resetting mcp_server_enabled when Duo settings change’ to 19-2-stable-ee
• Restore Slack notifications documentation page (19.2 backport)
• Increase staging_upload_template and production_release_template timeout from 35m to 60m
• Bump concurrent-ruby to version 1.3.8 (19-2-stable)
• Bump alertmanager to v0.34.0 (19-2-stable)
• Bump NGINX to 1.31.4
• update go 1.26.7 on 19-2-stable
• Update dependency redis/redis to v7.2.16 (19-2-stable)
• Bump PostgreSQL to version 17.11 (19-2-stable)
• Bump Consul to version 1.22.7 (19-2-stable)
• Merge branch ‘sdg-fips-staging-upload-internal-release’ into 19.2

19.1.8

• Update go to 1.25.14
• Revert “Merge branch ‘replace_ftp_gnu_org_with_mirror’ into 19.1
• Backport !8857 to 19-1: Fall back to full backup when previous step is non-existent
• Add whole-diff hash option to GetPatchID
• Backport of ‘Skip Lockable reset_failed_attempts! on read-only replicas’
• Backport of ‘Fix broken gcloud auth plugin package name in qa/Dockerfile’
• Quarantine flaky agentic chat custom-agent spec [19.1]
• Backport of ‘Fix empty partition range crashing pipeline lookups (CI outage)’ to 19-1
• Bump websocket-driver from 0.8.0 to 0.8.2 (backport to 19-1-stable-ee)
• Increase staging_upload_template and production_release_template timeout from 35m to 60m
• Bump concurrent-ruby to version 1.3.8 (19-1-stable)
• Bump alertmanager to v0.34.0 (19-1-stable)
• Bump NGINX to 1.31.4
• Update go to 1.25.14 on 19-1-stable
• Update dependency redis/redis to v7.2.16 (19-1-stable)
• Bump PostgreSQL to version 17.11 (19-1-stable)
• Bump Consul to version 1.22.7 (19-1-stable)
• Merge branch ‘sdg-fips-staging-upload-internal-release’ into 19.1

Important notes on upgrading

This patch includes database migrations that may impact your upgrade process.

Impact on your installation:

• Single-node instances: This patch will cause downtime during the upgrade as migrations must complete before GitLab can start.
• Multi-node instances: With proper zero-downtime upgrade procedures, this patch can be applied without downtime.

Post-deploy migrations

The following versions include post-deploy migrations that can run after the upgrade:

• 19.3.2

To learn more about the impact of upgrades on your installation, see:

• Zero-downtime upgrades for multi-node deployments
• Standard upgrades for single-node installations

Updating

To update GitLab, see the Update page. To update GitLab Runner, see the Updating the Runner page.

Receive Patch Notifications

To receive patch blog notifications delivered to your inbox, visit our contact us page. To receive release notifications via RSS, subscribe to our patch release RSS feed or our RSS feed for all releases.